From 05881d5a6ac4047e6b840e15a47e1d785629e058 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Fri, 18 Sep 2026 20:59:19 -0500 Subject: [PATCH] fix(conformance): regenerate the three L1 goldens the external-dns change drifted MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit b184a42 made the renderer stamp external-dns.alpha.kubernetes.io/controller: none on internal services' HTTPRoutes, but three L1 golden fixtures were never regenerated, so container-workload-render (R-PLAT-02) and egress-class-render (R-NET-05/06/07) failed. Exactly one line differs in each — the annotation and nothing else. WORTH RECORDING: the merge that caused this GATED GREEN. The requirement-scoped selection did not include R-PLAT-02 or R-NET-05/06/07, so neither check ran. A later docs-only commit shifted the touched set, selected them, and exposed a failure the earlier merge had introduced — meaning the gate reported PASS on a tree it had not actually checked in the relevant place. That is the same fail-open the whole-repo scope mechanism was built for, except that mechanism covers L0 only; L1 is still purely requirement-scoped. A renderer change can therefore drift any L1 golden whose requirements the change does not happen to attribute. Both affected checks are pure offline renders with no cluster dependency, so they are cheap to run unconditionally — declaring scope: whole-repo on the l1-rendering tests looks like the right follow-up. Also note the checks diff fail-fast: only egress-vpn was reported, while egress-internet had drifted identically and was never reached. Co-Authored-By: Claude Opus 5 --- .../l1-rendering/container-workload-render/golden/expected.yaml | 1 + .../egress-class-render/golden/egress-internet.expected.yaml | 1 + .../egress-class-render/golden/egress-vpn.expected.yaml | 1 + 3 files changed, 3 insertions(+) diff --git a/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml b/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml index 61726d3..a8d1db4 100644 --- a/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml +++ b/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml @@ -196,6 +196,7 @@ metadata: annotations: homelab.keithjackson.dev/auth-mode: forward-auth homelab.keithjackson.dev/auth-groups: platform-admins + external-dns.alpha.kubernetes.io/controller: none spec: parentRefs: - name: shared diff --git a/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml b/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml index 9591994..a13b7c2 100644 --- a/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml +++ b/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml @@ -223,6 +223,7 @@ metadata: annotations: homelab.keithjackson.dev/auth-mode: forward-auth homelab.keithjackson.dev/auth-groups: media-admins + external-dns.alpha.kubernetes.io/controller: none spec: parentRefs: - name: shared diff --git a/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml b/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml index 17c0524..dbccb46 100644 --- a/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml +++ b/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml @@ -223,6 +223,7 @@ metadata: annotations: homelab.keithjackson.dev/auth-mode: forward-auth homelab.keithjackson.dev/auth-groups: media-admins + external-dns.alpha.kubernetes.io/controller: none spec: parentRefs: - name: shared